Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Can someone provide me rules to detect following attack :

hping3 -S -p 80 --flood --rand-source [target]

I'm having problem with rules since packet comes from random source.

My current rules is :

alert tcp !$HOME_NET any -> $HOME_NET 80 (flags: S; msg:"Possible TCP DoS"; flow: stateless; threshold: type both, track by_src, count 70, seconds 10; sid:10001;rev:1;)

this rules only can detect from one source ip only.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:12

This question was marked as an exact duplicate of an existing question.

up vote 0 down vote accepted

Use "by_dst" to track by destination instead of "by_src" if you are worried about distributed attacks.


if i used "by_dst" normal request will also be counted in this rule, which this should not be case.

... that is why snort is no substitute for actively administering your server - a DDoS looks a lot like being popular on Digg at the network level (in either case, you'll want an alert when your server is unable to service requests rather than alerts on how many connections are being made).

This How to detect a DDoS attack? thread at Webmaster World might be a better place to start if you're more focused on identifying DDoS attacks than configuring snort.

share|improve this answer
thx this almost solved my problem, if i used "by_dst" normal request will also be counted in this rule, which this should not be case. How do we differentiate normal request which come from user browser and from this hping/other ddos tool ? – Adelave Sep 6 '10 at 11:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.